EntityRoleWhiteList metadata filter with Shib SP 2.4

[Michael A. Grady]

I had this white list working (I think) when I just had:

<MetadataFilter type="EntityRoleWhiteList">
  <RetainedRole>IDPSSODescriptor</RetainedRole>
</MetadataFilter>

but things break when I try to add the AttributeAuthorityDescriptor role:

<MetadataFilter type="EntityRoleWhiteList">
  <RetainedRole>IDPSSODescriptor AttributeAuthorityDescriptor</RetainedRole>
</MetadataFilter>

What basic mistake am I making?

--
Michael A. Grady                      
Executive Program Officer for Cyberinfrastructure
Office of the CIO, University of Illinois at Urbana-Champaign
2222 DCL, MC 256, 1304 W. Springfield Ave., Urbana, IL 61801
217.244.1253 phone, 217.244.4780 fax